Commit Graph

8482 Commits

Author SHA1 Message Date
Alexander Brandon Coles 9d4881216b Merge remote-tracking branch 'opf/dev' into HEAD
# Conflicts:
#	frontend/src/assets/sass/backlogs/_master_backlog.sass
#	modules/backlogs/config/locales/crowdin/ru.yml
#	modules/wikis/config/locales/crowdin/ru.yml
#	modules/wikis/config/locales/crowdin/uk.yml
#	modules/wikis/config/locales/crowdin/zh-CN.yml
2026-05-08 10:35:12 +02:00
Oliver Günther 7ae5604869 Merge pull request #23070 from opf/fix/relation-visible-scope
The performance decreased because of a combination of calls that were supposed to increase performance. 

We have a mechanism in place which automatically eager loads models needed in the element representers when a collection of them is rendered. This is to avoid N+1 queries of course. But, if eager loading is  combined with e.g., a LIMIT, which we do because we paginate, rails automatically falls back to issuing two instead of just one SQL statement. Which makes sense as otherwise LEFT JOINS might mess with the result set. 

But Rails does so in a somewhat simple fashion. It uses the first query to get the DISTINCT ids. The second is used to load the values (without a limit). But instead of removing all WHERE statements in the second SQL statement and then apply just the one for the ids, it keeps the original WHERE statement and applies the one for the ids on top. The problem with that is that the database trips on that (I didn't check the why) and uses a less than optimal query plan. 

That was the problem here as well. The first query remained reasonable quick (300ms) but the second one took 25s. 

The fix is to split the two statements by hand in the representer whenever eager loading is defined. The first query has all the filters but no eager loading and fetches the ids. The second takes the ids, and with eager loading included loads the data. Et voila, second query takes 10ms.   

That at least works for relations, work_packages and projects. But there are other representers that also seem to have custom behaviour. I'm looking into whether they can be easily adapted.
2026-05-07 15:44:13 +02:00
Klaus Zanders b3d51774b3 Merge pull request #22968 from opf/resource-management-module
Introduce Resource Management Module
2026-05-06 17:07:07 +02:00
OpenProject Actions CI 0778811719 Merge branch 'release/17.4' into dev 2026-05-06 12:47:03 +00:00
Oliver Günther c660802146 Merge remote-tracking branch 'origin/release/17.3' into release/17.4 2026-05-06 09:19:25 +02:00
Jan Sandbrink 5c31dadceb Merge pull request #22946 from opf/extract-wp-page-links
Create reverse page links from internal wiki to WorkPackages
2026-05-06 08:10:36 +02:00
Klaus Zanders 56e3d6214d Do not show Resource Management permissions in Role Editor 2026-05-05 15:30:51 +02:00
Oliver Günther 5bf27bb868 Merge remote-tracking branch 'origin/release/17.4' into dev 2026-05-05 12:29:43 +02:00
Andrej 49f2465efe Merge pull request #22998 from opf/bug/74536-errors-with-include-project-work-package-list-filter-with-a-portfolio
include filter working with portfolios and programs
2026-05-05 12:27:38 +02:00
Alexander Brandon Coles 83573af155 Merge dev into release merge branch
Resolve Backlogs sprint conflicts by porting the release assignability
changes onto the renamed Sprint model.
2026-05-05 08:51:13 +01:00
Jan Sandbrink 0b06198e6f Improve readability of patch_with_namespace
Using Ruby's splat operator to make clear how the module name is constructed,
avoiding the use of args[0..-2], which (IMO) is not easy to read.
2026-05-05 08:35:45 +02:00
Oliver Günther 80d8571992 Tighter css sanitization rules
So far, we've been using the relaxed sanitization rule set. We only need some styles for the table display in CKEditor,
other styles should not be allowed.
2026-05-04 15:12:31 +02:00
ulferts 1449f12197 bump grape & mustermann 2026-04-30 15:24:34 +02:00
David F 68f3d335fa Add optional hidden sentinel field for Primer’s checkbox groups. wp/74398 2026-04-30 11:10:28 +02:00
ulferts 222639f8d4 include filter working with portfolios and programs 2026-04-30 10:18:09 +02:00
Kabiru Mwenja 0d79f5358c Bust WP representer JSON cache when identifier mode flips (#22960)
Include identifier mode in WP representer cache key
2026-04-28 14:22:56 +03:00
Klaus Zanders a9a6898153 Remove inline disables for DynamicFindBy 2026-04-27 09:22:18 +02:00
Oliver Günther ab301f7de4 Merge pull request #22875 from opf/fix/validate-conditions-on-custom-action-execute
Validate conditions on execution of custom action
2026-04-27 08:41:04 +02:00
OpenProject Actions CI 9569225e56 Merge branch 'release/17.4' into dev 2026-04-25 04:23:14 +00:00
Oliver Günther 8eca1925ec Respect activation limit in user unlocking
https://community.openproject.org/work_packages/74373
2026-04-24 09:19:06 +02:00
Kabiru Mwenja 5d3abc6c80 Merge pull request #22858 from opf/implementation/74200-use-displayid-in-work-package-breadcrumbs
[#74200] Use displayId in work package breadcrumbs
2026-04-23 18:00:56 +03:00
Oliver Günther 6877e29351 Validate current user password confirmation when changing passwords through API
https://community.openproject.org/work_packages/74335
2026-04-23 14:19:50 +02:00
Oliver Günther 971fe2a45d Bumped version to 17.5.0
[ci skip]
2026-04-23 08:35:04 +02:00
OpenProject Actions CI ca54954220 Merge branch 'release/17.3' into dev 2026-04-23 04:33:10 +00:00
Oliver Günther 8ca79798db Validate conditions on execution of custom action
https://community.openproject.org/projects/openproject/work_packages/74294/activity
2026-04-22 14:12:42 +02:00
Oliver Günther 02ae6a9119 Remove password min-rules in favor of clearly listed/checked password rules
https://community.openproject.org/work_packages/73461
2026-04-22 13:43:42 +02:00
Oliver Günther 7135dfc2c4 Add additional validations for path validation for posix on repositories 2026-04-22 11:23:37 +02:00
Kabiru Mwenja b8471484e0 Include identifier in Hierarchy eager loader's children SELECT
The ancestors/children representer change calls `child.display_id`,
which consults `identifier` in semantic mode. The Hierarchy eager
loader preloads children with a minimal `SELECT id, subject, project_id,
parent_id` for performance, so `identifier` was missing and
`ActiveModel::MissingAttributeError` fired the moment a query endpoint
rendered a work package with visible children in semantic mode.

Add `identifier` to the SELECT. It's one extra short text column per
child row.
2026-04-22 08:50:32 +03:00
Kabiru Mwenja 3e0f738c2c Expose displayId on work package ancestor and children HAL links
In semantic mode, the work package breadcrumb renders numeric IDs
instead of the semantic identifier because ancestor HAL resources are
built from `_links.ancestors[]` entries that only carry `href` and
`title`. With no top-level `displayId` in `$source`, the frontend getter
falls through to the numeric id parsed from the href.

Emit `displayId` alongside `href`/`title` on each ancestor and child
link in the representer, and have the `displayId` getter fall back to
the self link's `displayId` so resources built from a link payload
alone still surface the semantic identifier.
2026-04-22 08:18:54 +03:00
Pavel Balashou 10f2ed7efe Merge pull request #22842 from opf/jira-import-ssrf
Use ssrf filtering in Jira Import.
2026-04-21 15:26:40 +02:00
Tobias Dillmann a42eb98f87 [#73104] Move api resource link out of the model 2026-04-21 13:55:12 +02:00
Tobias Dillmann 4d3205636e [#73104] Remove backlogs module pollution from core
We delegate the resource name to the object itself, that way we can
override it in our record and no knowledge about the backlogs module is
necessary in the core.
2026-04-21 13:55:12 +02:00
Tobias Dillmann 281e44762f [#73104] Allow resource linking for sprints
This is necessary to make the group_by work
2026-04-21 13:55:12 +02:00
Kabiru Mwenja 234a870060 Merge pull request #22704 from opf/feature/73716-adapt-work-package-show-view-for-project-based-semantic-work-package-identifiers
Adapt work package show view for semantic identifiers
2026-04-21 13:52:23 +03:00
Kabiru Mwenja 79d4e67a0d Merge pull request #22718 from opf/feature/73756-adapt-routes-for-project-based-semantic-work-package-identifiers
Make find/exists? resolve semantic work package identifiers
2026-04-21 13:13:54 +03:00
Oliver Günther a92edf17a6 Merge remote-tracking branch 'origin/release/17.3' into dev 2026-04-21 11:00:11 +02:00
Oliver Günther 61266cd96b Validate use of existing managed repository paths
https://community.openproject.org/work_packages/74165
2026-04-21 10:59:52 +02:00
Pavel Balashou 53e33770c2 Use ssrf filtering in Jira Import. 2026-04-21 10:29:45 +02:00
Oliver Günther fad228d8d3 Remove style with content 2026-04-20 19:38:03 +02:00
Oliver Günther 12160eab43 Add svg to remove list 2026-04-20 19:38:03 +02:00
Oliver Günther 4abbc75f22 Remove commonmarker GFM tagfilter extension
We already use our own extensive sanitization pipeline, and it turns out
tagfilter is extremely slow on large oneline input (such as big tables).

Rendering a large table inside a work package (2k rows, 20k cells) caused tagfilter to run for over 2 minutes.
Added a separate spec to test all tags the tagfilter filters for to avoid its runaway execution time.
2026-04-20 16:52:10 +02:00
Oliver Günther 098bd4927c Bumped version to 17.3.2
[ci skip]
2026-04-20 13:08:33 +02:00
Klaus Zanders 8d15647333 Merge pull request #22372 from opf/departments-admin-menu
Manage organizations in Admin Menu
2026-04-20 12:39:43 +02:00
Alexander Brandon Coles 7b3b6bdbf3 Clean up remaining Backlogs dead code
Restore the minimal admin settings blankslate so the admin menu route
remains valid after the sprint-based cleanup. Remove the remaining
settings-driven story/task classification code, dead models and
services, and the obsolete filter and spec setup that depended on it.
2026-04-17 10:14:14 +01:00
OpenProject Actions CI 0c68614c6e Merge branch 'release/17.3' into dev 2026-04-17 04:32:30 +00:00
Klaus Zanders 710eac52ba Do not allow changing the organizational_unit flag and allow setting parent in the API 2026-04-16 18:11:13 +02:00
Oliver Günther 96397d7388 Explicit path validation on svn targets
https://community.openproject.org/work_packages/73978
2026-04-16 15:51:52 +02:00
Kabiru Mwenja 6c02cd1fea Separate displayId from wp.id to fix cascading bugs
Overriding wp.id to return the semantic identifier (e.g. "PROJ-42")
broke cache keys, API filters, row rendering, and CSS selectors that
all depend on the numeric PK.

Instead, keep wp.id as the numeric PK and add two new properties:
- displayId: returns the user-facing identifier ("PROJ-42" or "123")
- displayIdWithHash: returns "#PROJ-42" or "#123" for UI display

Also adds a COALESCE fallback in the SQL representer so work packages
created before semantic mode was enabled still get a valid displayId.
2026-04-15 18:59:42 +03:00
Kabiru Mwenja 8d13c2ac93 Fix grammar in multi-argument error and clarify API route param
- "find are not yet supported" → "find is not yet supported"
- Add semantic identifier example to API route param description
2026-04-15 16:42:18 +03:00
Jan Sandbrink 61c6f8f616 Merge pull request #22758 from opf/extend-pattern-matcher-filter
Allow to extend PatternMatcherFilters via method call
2026-04-15 13:08:50 +02:00